Re: [PATCH] Free skb at error context in auditd_send_unicast_skb().

[Paul Moore]

On Mon, Jul 17, 2017 at 11:50 AM, Masami Ichikawa <masami256@xxxxxxxxx> wrote:
> I got following memory leak reports by kmemleak.
>
> unreferenced object 0xffff965962fa0600 (size 256):
>   comm "auditd", pid 401, jiffies 4294671604 (age 62.331s)
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace:
>     [<ffffffffb8859baa>] kmemleak_alloc+0x4a/0xa0
>     [<ffffffffb8238a96>] kmem_cache_alloc_node+0x146/0x1f0
>     [<ffffffffb870e52b>] __alloc_skb+0x5b/0x1e0
>     [<ffffffffb814fc5c>] audit_make_reply+0x5c/0xd0
>     [<ffffffffb815160a>] audit_receive_msg+0xa1a/0xe60
>     [<ffffffffb8151aa3>] audit_receive+0x53/0xa0
>     [<ffffffffb875e95b>] netlink_unicast+0x18b/0x220
>     [<ffffffffb875ecb5>] netlink_sendmsg+0x2c5/0x3c0
>     [<ffffffffb8705008>] sock_sendmsg+0x38/0x50
>     [<ffffffffb870558f>] SYSC_sendto+0x13f/0x180
>     [<ffffffffb870608e>] SyS_sendto+0xe/0x10
>     [<ffffffffb8003a57>] do_syscall_64+0x67/0x140
>     [<ffffffffb8865ca7>] return_from_SYSCALL_64+0x0/0x6a
>     [<ffffffffffffffff>] 0xffffffffffffffff
> unreferenced object 0xffff96595a9da600 (size 512):
>   comm "auditd", pid 401, jiffies 4294671604 (age 62.331s)
>   hex dump (first 32 bytes):
>     14 00 00 00 31 05 00 00 00 00 00 00 00 00 00 00  ....1...........
>     91 01 00 00 01 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace:
>     [<ffffffffb8859baa>] kmemleak_alloc+0x4a/0xa0
>     [<ffffffffb823c8a3>] __kmalloc_node_track_caller+0x233/0x2f0
>     [<ffffffffb870d9d1>] __kmalloc_reserve.isra.38+0x31/0x90
>     [<ffffffffb870e557>] __alloc_skb+0x87/0x1e0
>     [<ffffffffb814fc5c>] audit_make_reply+0x5c/0xd0
>     [<ffffffffb815160a>] audit_receive_msg+0xa1a/0xe60
>     [<ffffffffb8151aa3>] audit_receive+0x53/0xa0
>     [<ffffffffb875e95b>] netlink_unicast+0x18b/0x220
>     [<ffffffffb875ecb5>] netlink_sendmsg+0x2c5/0x3c0
>     [<ffffffffb8705008>] sock_sendmsg+0x38/0x50
>     [<ffffffffb870558f>] SYSC_sendto+0x13f/0x180
>     [<ffffffffb870608e>] SyS_sendto+0xe/0x10
>     [<ffffffffb8003a57>] do_syscall_64+0x67/0x140
>     [<ffffffffb8865ca7>] return_from_SYSCALL_64+0x0/0x6a
>     [<ffffffffffffffff>] 0xffffffffffffffff
>
> These skb objects have been allocated in audit_replace().
> If some error happened in auditd_send_unicast_skb(), skb is needed
> to be freed.
>
> Signed-off-by: Masami Ichikawa <masami256@xxxxxxxxx>
> ---
>  kernel/audit.c | 1 +
>  1 file changed, 1 insertion(+)

Thank you for the problem report and the fix.  I'm going to merge this
into audit/stable-4.13 and I'll send it to Linus later in the week.

> diff --git a/kernel/audit.c b/kernel/audit.c
> index 833267bbd80b..789f4cc1f481 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -659,6 +659,7 @@ static int auditd_send_unicast_skb(struct sk_buff *skb)
>  err:
>         if (ac && rc == -ECONNREFUSED)
>                 auditd_reset(ac);
> +       kfree_skb(skb);
>         return rc;
>  }
>
> --
> 2.13.0
>



-- 
paul moore
www.paul-moore.com